feat: publish Toolbox 0.12.0 with Auth Tools 0.2.0

.env.example

@@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup
 
 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.11.0
+TOOLBOX_RELEASE_VERSION=0.12.0
-TOOLBOX_RELEASE_SHA256=752c91606ba4249da8eb0a6d2d062b9dfe10fec988f16d428ba1c9b899ba4771
+TOOLBOX_RELEASE_SHA256=70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc

Containerfile.release

@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3
 
 FROM ${NGINX_IMAGE} AS release
 
-ARG TOOLBOX_RELEASE_VERSION=0.11.0
+ARG TOOLBOX_RELEASE_VERSION=0.12.0
-ARG TOOLBOX_RELEASE_SHA256=752c91606ba4249da8eb0a6d2d062b9dfe10fec988f16d428ba1c9b899ba4771
+ARG TOOLBOX_RELEASE_SHA256=70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download
 
 RUN set -eu; \

README.md

@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal
 
 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.13` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.14` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik
 
 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.11.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.12.0 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -106,7 +106,7 @@ prefix while the public URL remains `/`, so assets remain relative and the brows
 binds WebAuthn credentials to the dedicated `auth.toolbox.add-ideas.de` RP ID.
 The main Toolbox copy at `/apps/auth/` remains useful for offline inspection but
 disables live ceremonies because all Portal apps share that origin. The router
-hostname can be overridden with `AUTH_TOOLS_HOST`, but auth-tools 0.1.0 enables
+hostname can be overridden with `AUTH_TOOLS_HOST`, but auth-tools 0.2.0 enables
 live ceremonies only on its pinned production host (or localhost); other hosts
 remain inspect-only. Never widen the RP ID to `add-ideas.de`.
 
@@ -131,10 +131,10 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.
 
-`release/toolbox.lock.json` is the reviewed v0.11.0 lock. Its URLs and checksums
+`release/toolbox.lock.json` is the reviewed v0.12.0 lock. Its URLs and checksums
 pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
 Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, and OTP & Passkey
-Tools 0.1.0 release bytes. Use
+Tools 0.2.0 release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:
 
@@ -155,7 +155,7 @@ npm run assemble -- \
   --lock release/toolbox.lock.json \
   --portal-dist dist \
   --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.11.0.zip
+  --archive build/add-ideas-toolbox-0.12.0.zip
 ```
 
 Existing output is refused. Pass `--force` only when replacing those exact
@@ -179,8 +179,8 @@ build/toolbox/
     ├── svg/
     └── auth/
 
-build/add-ideas-toolbox-0.11.0.zip
+build/add-ideas-toolbox-0.12.0.zip
-build/add-ideas-toolbox-0.11.0.zip.sha256
+build/add-ideas-toolbox-0.12.0.zip.sha256
 ```
 
 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -201,7 +201,7 @@ directory separately:
 ```sh
 npm run package:static -- \
   --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.11.0.zip
+  --output artifacts/add-ideas-toolbox-0.12.0.zip
 ```
 
 This also emits a `.sha256` sidecar.
@@ -222,9 +222,9 @@ normal local XML/XSLT transformations do not require that permission.
 
 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/lotobo/toolbox:0.11.0 .
+  -t git.add-ideas.de/lotobo/toolbox:0.12.0 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/lotobo/toolbox:0.11.0
+  git.add-ideas.de/lotobo/toolbox:0.12.0
 ```
 
 For a direct-port local deployment after assembly, use the separate example:
@@ -241,7 +241,7 @@ docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
   --file Containerfile.release \
-  --tag git.add-ideas.de/lotobo/toolbox:0.11.0 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.12.0 \
   --tag git.add-ideas.de/lotobo/toolbox:0.11 \
   --push .
 ```
@@ -267,8 +267,8 @@ needs permission to push code, releases, and container packages to
    all seven apps, switch between them, and confirm the encoded `toolbox`
    context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.11.0.zip.sha256)`.
+   `(cd build && sha256sum -c add-ideas-toolbox-0.12.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.11.0`), and
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.12.0`), and
    push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
    static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -283,15 +283,15 @@ must not re-resolve app versions or substitute a newer release.
 
 ## Existing tools
 
-| Tool                | State and boundary                                        | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                                                                   | Critical considerations and integrations                                                                                                                                                                                                                                                 |
+| Tool                | State and boundary                                        | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                                                                   | Critical considerations and integrations                                                                                                                                                                                                                                                                                   |
-| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                              |
+| **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                                                                |
-| **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                               |
+| **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                                                                 |
-| **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                      |
+| **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                                                        |
-| **`av-tools`**      | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                       | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                           |
+| **`av-tools`**      | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                       | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                                                             |
-| **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
+| **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics                                   |
-| **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository  | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                          |
+| **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository  | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                                                            |
-| **`auth-tools`**    | Initial local-first v0.1.0 release; dedicated repository  | Generate, inspect and verify OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                      | HOTP, TOTP and OCRA; strict provisioning URIs; QR, CSV, Google migration and plain PSKC import; bounded CBOR/authenticator-data inspection; assertion verification; an ephemeral browser ceremony lab                                                                                                                                                      | OTP material remains memory-only; attestation trust is not claimed; live ceremonies are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin (or localhost), while the Portal path remains inspect-only; no raw CTAP or token administration                           |
+| **`auth-tools`**    | Current local-first v0.2.0 release; dedicated repository  | Generate, inspect and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                    | HOTP, TOTP, OCRA, T0/time travel, drift/timelines/vectors, multi-QR and authenticator-backup migration, QR decode, health reports and encrypted export; bounded CBOR/authenticator-data inspection; assertion and attestation verification; imported FIDO metadata; ephemeral browser ceremony lab                                                         | OTP material remains memory-only unless explicitly exported; attestation signature, metadata and trust are reported separately; live ceremonies are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin (or localhost), while the Portal path remains inspect-only; no raw CTAP or token administration |
 
 ## Planned tools
 

compose.example.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: git.add-ideas.de/lotobo/toolbox:0.11.0
+    image: git.add-ideas.de/lotobo/toolbox:0.12.0
     restart: unless-stopped
     read_only: true
     ports:

compose.yaml

@@ -6,9 +6,9 @@ services:
       context: .
       dockerfile: Containerfile.release
       args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.11.0}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.12.0}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-752c91606ba4249da8eb0a6d2d062b9dfe10fec988f16d428ba1c9b899ba4771}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc}"
-    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.11.0}"
+    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.12.0}"
     restart: unless-stopped
     read_only: true
     tmpfs:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.13",
+      "version": "0.2.14",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@add-ideas/toolbox-contract": "^0.2.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The source code corresponding to add·ideas Toolbox Portal 0.2.13 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.14 is available at:
 
-https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.11.0
+https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.12.0
 
 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.

release/toolbox.lock.example.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.11.0",
+  "releaseVersion": "0.12.0",
-  "portalVersion": "0.2.13",
+  "portalVersion": "0.2.14",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -57,9 +57,9 @@
     },
     {
       "id": "de.add-ideas.auth-tools",
-      "version": "0.1.0",
+      "version": "0.2.0",
-      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.1.0/auth-tools-0.1.0.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.2.0/auth-tools-0.2.0.zip",
-      "sha256": "1f65f07e2d89c1ff115ae276542f406277fc01c85e8845648522708a9c8f3f18",
+      "sha256": "fce3fc07095b0460889d2cda4875093233438d7ad924e77464dd1164be089b09",
       "target": "auth"
     }
   ]

release/toolbox.lock.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./toolbox-release-lock.schema.json",
   "schemaVersion": 1,
-  "releaseVersion": "0.11.0",
+  "releaseVersion": "0.12.0",
-  "portalVersion": "0.2.13",
+  "portalVersion": "0.2.14",
   "catalogue": {
     "id": "de.add-ideas.toolbox",
     "name": "add·ideas Toolbox",
@@ -57,9 +57,9 @@
     },
     {
       "id": "de.add-ideas.auth-tools",
-      "version": "0.1.0",
+      "version": "0.2.0",
-      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.1.0/auth-tools-0.1.0.zip",
+      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.2.0/auth-tools-0.2.0.zip",
-      "sha256": "1f65f07e2d89c1ff115ae276542f406277fc01c85e8845648522708a9c8f3f18",
+      "sha256": "fce3fc07095b0460889d2cda4875093233438d7ad924e77464dd1164be089b09",
       "target": "auth"
     }
   ]

scripts/assembler.test.ts

@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
   return {
     schemaVersion: 1,
     releaseVersion: '0.1.0',
-    portalVersion: '0.2.13',
+    portalVersion: '0.2.14',
     catalogue: {
       id: 'de.add-ideas.toolbox',
       name: 'Test Toolbox',

src/App.tsx

@@ -489,9 +489,9 @@ export default function App() {
             </span>
           </p>
           <span>
-            Portal v0.2.13 ·{' '}
+            Portal v0.2.14 ·{' '}
             <a
-              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.11.0"
+              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.12.0"
               target="_blank"
               rel="noopener noreferrer"
             >